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Abstract 

Fatal loss-of-control (LOC) accidents have been directly related to in-flight airframe icing. The 
prototype system presented in this paper directly addresses the need for real-time onboard envelope 
protection in icing conditions. The combinations of a-priori information and real-time aerodynamic 
estimations are shown to provide sufficient input for determining safe limits of the flight envelope during 
in-flight icing encounters. The Icing Contamination Envelope Protection (ICEPro) system has been 
designed and implemented to identify degradations in airplane performance and flying qualities resulting 
from ice contamination and provide safe flight-envelope cues to the pilot. Components of ICEPro are 
described and results from preliminary tests are presented. 

Introduction 

The University of Tennessee Space Institute (UTSI) in partnership with Bihrle Applied Research 
(BAR) has completed a 3 -year cooperative research effort with NASA in response to the NASA Research 
Announcement (NRA) NNH06ZEA001N under Appendix B of the Aviation Safety Program. A prototype 
Icing Contamination Envelope Protection (ICEPro) system was developed to meet the objectives defined 
under the Integrated Vehicle Health Management (IVHM) Project, topic IVHM 3.1, Environmental 
Hazards, which are caused by the “Effects of Icing on Aircraft State”. This paper presents the results of 
this research, which focuses on the concept, design, development, implementation, and evaluation of the 
real-time vehicle state assessment system. 


Background 

Airframe icing continues to be a threat to aviation safety across the globe. Icing-induced loss of 
control incidents and accidents have occurred and continue to occur on all classes of aircraft — from 
general aviation airplanes (Ref. 1) and business jets (Ref. 2), to transport category aircraft (Refs. 3 to 8) 
NASA recently published results from statistical analyses that examined trends of icing-related events 
over a 16-year period (1988 to 2003) (Ref. 9). The study showed that nearly 9-percent of all fatal 
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accidents from Part 121 and Scheduled Part 135 operations occurred while flying in icing conditions. 
During an icing encounter, flight characteristics can be severely degraded if hazardous ice formations 
accrete on wings and tail surfaces due to improper use of the ice protection systems (IPS), IPS failure, or 
encountering “exceedance conditions”. Exceedance conditions occur when an aircraft is exposed to icing 
conditions outside of the FAR 25 Appendix C criteria, for which the aircraft is certificated. This is often 
referred to as Super-cooled Large Droplet (SLD) icing conditions. Each of these situations has caused 
serious aircraft handling problems and resulted in stall and/or departure from controlled flight. 

One notable accident referenced above involved an ATR 72 that flew through SLD icing conditions 
near Roselawn, Indiana on October 31, 1994. Even with the IPS operating normally, the aircraft 
experienced a roll control anomaly that led to the loss of control and impact into the ground. This accident 
and others since then have led to numerous safety recommendations from the National Transportation 
Safety Board (NTSB) (Refs. 10 and 11) and the Commercial Aviation Safety Team (CAST) (Ref. 12) and 
motivated research activities within NASA and the FAA. One NASA sponsored activity called the Smart 
Icing Systems was led by the University of Illinois, Urbana-Champaign (UIUC). The Smart Icing 
Systems took a systems level approach to detecting icing conditions, operating ice protection systems and 
alerting the flight crew to the status of the aircraft (Ref. 13). 

This work laid the foundation to continue research to develop and improve real-time state assessment 
methods for vehicle health management with application to detecting and mitigating icing hazards. This 
effort was performed under a NRA with the UTS1 and BAR, in collaboration with the NASA Glenn and 
NASA Langley Research Centers. The development of real-time state assessment methods and their use 
in providing flight and control limit information to the pilot through cues and messaging on his displays 
are an essential aspect of this research effort. 

The final developed Icing Contamination Envelope Protection (ICEPro) system was evaluated by a 
group of pilots to assess their performance using the provided cues and messages while performing a 
typical 1FR approach and landing compared to a control group who did not have the cues. 

Details of the design, implementation, and verification process of this unique system, as well as a 
synopsis of the piloted evaluations and conclusions are contained herein 


ICEPro Concept 

The ICEPro concept is best summarized by the hypothesis posed by the development team during 
preliminary stages of the design process. 

By the real-time processing of measured state and control information, estimates of stability and 
control can be used in conjunction with a knowledge base, comprised of a-priori data, to provide 
pilots with envelope-limiting cueing in order to avoid loss-of-control or adverse conditions resulting 
from in-flight icing. 

The ICEPro system was designed and implemented to identify degradations in airplane performance 
and flying qualities resulting from ice contamination and to provide safe flight-envelope cues to the pilot. 
This is accomplished by the real-time processing of measured state and control information to provide 
estimates of stability and control characteristics that are then used in conjunction with a knowledge base, 
comprised of a-priori data, to provide pilots with envelope-limiting cueing in order to avoid loss-of- 
control or adverse conditions resulting from in-flight icing. 

The ICEPro concept relies on the actions of a proficient pilot responding to appropriate cueing and 
information on the primary and secondary displays in the cockpit. It is believed that, with these cues, the 
pilot can make informed decisions as to how the airplane is being flown. The ICEPro concept provides 
envelope protection by issuing advisories, cautions, and warnings in the form of airspeed limits, angle of 
attack limits, flap position limits, and control effectiveness status. The indications are intended to be 
consistent with typical advisories and warnings that appear on flight displays such that they are intuitive 
and effective. Figure 1 provides a graphic illustrating the cueing that is used in the system. 
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Color-coded 
Velocity Limit 
Carets • 
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AOA Limit Flap Position and Control Surface Control Surface 
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Stability & Control 
Caution & Warning 
Lights 


Color-coded 
Flap Position 
Indicator 


Climb Limit 
Due to Icing Indicator 


Color-coded 
Stability & Control 
Caution & Warning Messages 


Figure 1 . — ICEPro envelope protection cues on the primary flight display (left) and flight control status page (right). 


When the system does not detect any change from the nominal a priori airplane characteristics, no 
cuing or messages appear and the instruments display the nominal flight information. When the system 
senses icing contamination that exceeds the system thresholds and latching logic, cues and possibly 
messages appear in conjunction with the normal display information. 

There are three types of information that are provided when an icing contamination is determined: 


• Airspeed limit carets and angle of attack limit brackets. 

- These are displayed whenever an ice contamination is determined by the ICEPro system. 

• Status messages 

- These will appear, both on the primary flight display and on the Flight Control Display 
(FCD) page in the message box. They indicate that there is a control and/or stability 
degradation in the indicated axis. There is also a message that appears whenever the single- 
engine climb capability is outside of safe limits. A flap limit message will also appear when 
the flaps should be retracted back to a safer deflection. 

• Flight control status indicators 

- The FCD page includes a rough diagram of the airplane showing its control surfaces. The 
surfaces are colored and the color will change whenever degradation is determined in their 
axis. With no degradation, the surfaces are green and turn amber when there is a caution 
displayed for that axis and red when there is a warning. 

The ICEPro System has three modes of operation: a MONITOR mode that provides initial detection of 
in-flight icing, an ID mode that provides a diagnosis of the condition, and a REPORTING mode, providing 
the prognosis of the condition and mitigation through cueing. Figure 2 presents a simplified flow diagram of 
the system modes and states. Details, such as latching and de-latching logic and specific logic for driving 
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each of the caution/waming messages have been omitted to reduce the complexity of the diagram. Details of 
the system design can be found in a paper presented by D.R. Gingras at the 2009 Aerospace Sciences 
Conference in Orlando, Florida (Ref. 14). As indicated in the diagram the system is heavily dependent on 
input from two components: The Dynamic Inversion Control Evaluation System (D-1CES), an algorithm 
that provides predictions of clean and iced aircraft flight characteristics, and a real-time parameter 
identification routine. Results from these components are used to determine an Icing Severity Parameter 
(ISP) which is used in logic for issuing pilot cues and warnings during the reporting mode. 


Monitor Mode 
IMODE = 0 


Flight Data 


D-ICES Data 
(drag + controls) 



IMODE = 0 
Stay in Monitor Mode 


a priori aero 
derivatives 


Start RTPID 


ID Mode 
IMODE = 1 


PID aero derivatives 


Calculate ISP 




Report Mode 
IMODE = 2 


Yes 


Update ISP 



Figure 2. — Simplified ICEPro system state diagram. 
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Flight Characteristic Predictions 

Development 

The flight characteristics predictions of the vehicle are made using a system hosted flight model, 
which for the development was that of a DeHavilland DHC-6 Twin Otter. This flight model was derived 
from a comprehensive nonlinear 6-degree-of-freedom simulation that was developed by Bihrle Applied 
Research and engineers at the NASA Glenn Research Center (Ref. 15). This model was based on data 
from extensive wind-tunnel tests using sub-scale models of the Twin-Otter and supplemented with flight 
data provided by NASA. This model covers the entire flight envelope including stall and post-stall flight 
regimes with and without icing effects resulting from ice accretion on the main wing, horizontal tail, and 
vertical tail. 

During previous efforts this model had undergone extensive validation against flight data to achieve 
high confidence predictions of aerodynamic characteristics in clean, no ice configuration, as well as the 
aerodynamic characteristics from an iced configuration representing an IPS failure situation. Figure 3 
contains a flow diagram of the process used during this effort to ensure accurate predictions of the 
aerodynamic coefficients. Figure 4 contains an example of the resulting comparisons with flight data of 
an elevator doublet for the clean airplane. 


a, P, Speed, Altitude, Linear 



Figure 3. — Process used for aerodynamic model validation. 
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Figure 4. — Example of comparisons of the simulation 
model and flight aerodynamic coefficients. 


In the ICEPro system this model is driven using a process similar to that show in Figure 3. Instead of 
recorded flight data as the input, predictions of clean and ice contaminated aerodynamic characteristics 
are determined using real-time flight measured state and control surface data. 


Real-Time Model Estimates 

Because the system compares model predictions described above with the current state, real time 
estimates are used. These estimates are computed by invoking real-time parameter identification 
(RTPID). The RTPID algorithm being employed was developed by Morelli (Ref. 16), and is based on a 
frequency domain approach implemented in version 2.0 of System IDentification Programs for AirCraft 
(SIDPAC) (Refs. 17 and 18). 

The approach uses a linearized model of the vehicle dynamics, Equation (1), where A, B, C, and D are 
matrices containing stability and control derivatives. 


x(t) = Ax(t) + Bu(t) x(0)-x o 
y(t) = Cx(t) + Du (t) 


( 1 ) 
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Time -varying estimates of the stability and control derivatives are determined using measured 
airplane control surface deflections and measured states from air data, angular rates, and attitude. Outputs 
are rotational and translational accelerations. To determine the estimates, a cost function is formulated in 
the frequency domain from the Fourier transform of the model in Equation (1), 

ycox(co) = Ax^coj + Bu^co) 

( 2 ) 

y(co) = Cx(co) + £>«(<») 


The cost function is 
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for m frequencies 


(3) 


where a k and b k are the Mi row of matrices A and B, respectively, and x k («) = x k (co„ ), u k ( n ) = u k (co ;j ) . 

Each line in Equation (2) can be analyzed separately in this way, which implements an equation-error 
formulation (Ref. 16). The least squares cost function in each case can be formulated as 


J = ^(Y-X$f (Y-XQ) 
where 1 indicates complex conjugate transpose, 
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and the unknown parameters from A and B are contained in the parameter vector 0. The least squares 
parameter vector estimate is obtained as the value of 0 that minimizes the cost function in Equation (4) 
(Ref. 19). 
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(6) 


Performing the identification in the frequency domain is advantageous for this application because of 
computational efficiency, robustness to noise and data dropouts, and reliable confidence bounds from the 
covariance matrix. To ensure reliable estimates, the ICEPro features a self checking algorithm that 
examines the confidence bound of the parameter estimates. Table 1 lists the parameters that are being 
identified in real-time. 

If confidence of the estimated parameters falls below acceptable levels due to lack of data information 
content, an automated excitation of the aircraft control surfaces is triggered to improve data information 
content. This interface with the subject vehicle is performed as though an autopilot is driving control 
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deflections using multi-frequency orthogonal inputs (Ref. 19). Amplitudes of the inputs are adjusted to 
provide excitation while minimizing vehicle motion. 


TABLE 1 .—AERODYNAMIC PARAMETERS IDENTIFIED BY RTPID 



System Implementation 

The ICEPro system was developed and deployed in Bihrle Applied Research’s D-Six PC-based 
simulation environment. All of the ICEPro functions, including the software for driving the flight displays 
are provided in a single computer that runs the software in real time. The system can be interfaced with 
NASA’s lee Contamination Effects Flight Training Device, ICEFTD (Fig. 5), or mounted in the NASA 
Twin Otter aircraft for flight demonstrations. The system includes all of the Data Acquisition and 
Executive functions which control the various modules that make up the system. 



Figure 5. — NASA’s Ice Contamination Effects Flight Training Device (ICEFTD). 
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The data acquisition portion receives data from the data bus on the airplane or from an emulation of 
the airplane data system if it is working with the simulator and not the airplane. It then makes the 
appropriate data available to the various other modules for processing and to the cockpit displays. The 
Executive portion provides all of the logic and calculation modules required to determine the icing state 
and what cues should be provided to the pilot. 

The ICEPro system was first developed using a desktop simulation running in D-Six. The module 
development and all of the initial check out and tuning were all done in this manner. Once the system was 
mature enough to permit piloted evaluations it was migrated to the 1CEFTD, which also used the D-Six 
environment. On the desktop implementation, the ICEPro modules and the Twin Otter simulation were 
run on the same computer. For the 1CEFTD implementation, a separate computer was used for the ICEPro 
modules. Communication with the 1CEFTD was accomplished over an Ethernet connection. This 
implementation was used to closely emulate the hoped for eventual implementation in the actual airplane. 
If this were to occur, the same computer could be similarly connected to the airplane’s data acquisition 
system. Because both the desktop simulation and the ICEPro computer attached to the 1CEFTD were 
running in the D-Six environment, migration from one to the other entailed simply copying the module 
files from one to the other. 

The 1CEFTD piloted simulations provided synthetic environment to assess and tune the final 
thresholds and latching logic for the cues and messages. They also afforded the opportunity to assess the 
effect of control surface excitation for the RTP1D routine on the pilot. The piloted simulation was also 
instrumental in evaluating the appearance and validity of the caution/waming messages, and for 
development and evaluation of aural and tactile cues that were incorporated for the guest pilot evaluations 
that were subsequently performed following the development stage. They were also used to develop and 
evaluate the scenario to be used for the guest pilot evaluations. 


Engineering Station 

An engineering station was set up that enabled the operator to set key parameters of the ICEPro 
system, monitor the performance of the system, and interact with the implemented logic during the 
development and evaluation phases of the program. The engineering station consisted of a set of 
Graphical User Interfaces (GUIs) that were displayed on two monitors attached to the computer running 
the ICEPro routines. 

The first window (Fig. 6) shows the status of the system. It shows in which mode the system is 
currently operating (Monitor, ID, or Report), whether the controls are being excited, the duration and 
magnitude of the excitations in each axis, as well as the time since reset of both the D-1CES and Real 
Time Parameter Identification (RT-P1D) modules. There is also a window that displays system status 
messages and buttons to reset the system modules and settings. 

The duration and magnitude of the surface excitations can be adjusted in this GUI and the excitation 
can be manually triggered when the system is in the ID or Report modes. It is also possible to manually 
reset either the D-1CES or RT-P1D routines from this window. 

There are a series of default thresholds, time delays, etc. that are used by the ICEPro logic modules 
that are preloaded with the system. All of the default values of these parameters can be overridden by 
inputting new values in an included text file. There are two buttons at the bottom of the GUI to either 
update these system settings from the text file, or to reset them to the default values. 

The D-1CES status window (Fig. 7) shows the a priori model values of the longitudinal and lateral- 
directional derivates for both the clean and fully iced airplanes at the current aircraft states. These 
linearized derivatives are extracted at the current state from the stored non-linear model data contained in 
the D-ICES routines. The set of derivatives presented are the same ones that are extracted by the RT-P1D 
module. 

There is also a similar window for the RT-P1D system that shows the comparable real time P1D 
determined derivatives (Fig. 8). Because the RT-P1D system only runs in the ID and Report modes, the 
values will not be updated when the system is operating in the Monitor mode. The operator can readily 
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compare the values from the D-1CES and RT-P1D status windows to evaluate the differences between the 
a priori clean or iced values, and the current actual values as determined by RT-P1D. A set of plots of 
such a comparison is presented in Figure 9. 



Figure 6. — System status window. 
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Figure 7. — D-ICES status window. 
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Figure 8. — RT-PID status window. 
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Figure 9. — Comparison of RT-PID results with D-ICES predictions, with and without contamination. 


Because the ICEPro system modules are running within a D-Six project, all of the normal D-Six 
interface tools are also available at the engineering station. As a result, any of the aircraft variables that 
are passed from the 1CEFTD as the simulated airplane data bus are available to monitor in real time 
listings, on strip charts, or as post-run engineering plots. Pertinent ICEPro variables are placed in data 
matrices that are also passed as D-Six variables and are similarly available for real time monitoring and 
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post-run analysis. At the end of the run, the time histories of these variables can be recorded for later 
analysis or for play back. The system also provides for strip charts of any of the RT-PID derivative values 
along with their expected values and the calculated error bands of the data. 

For the piloted evaluations, the 1CEFTD was enclosed within a black curtain that was provided to 
isolate the evaluation pilots form the rest of the room, thus providing a more realistic environment with 
no outside distractions. Consequently, the person manning the engineering station could not see the 
1CEFTD instrument panel. Therefore, a copy of the PFD that duplicated the information displayed to the 
pilot was provided for monitoring at the engineering station. 

System Calibration 

A considerable amount of effort was expended fine-tuning the system to develop a tool that would 
provide adequate warning and guidance when an icing condition was encountered but which would not 
have any false indications or nuisance messaging. The efforts to accomplish this evolved into three main 
areas: determining which terms to include in the ISP calculation, tuning thresholds and latching and de- 
latching logic, and developing logic for when the RT-PID routine gets reset. 

Icing Severity Parameter Determination 

As shown in Equation (7), the ISP was formulated as the sum of the difference between the actual 
(RT-PID derived values) and expected (a priori clean) derivative values divided by the difference between 
the a priori clean and fully iced values for the selected derivatives. It was found to be impractical to use 
all of the RT-PID derived terms. The yawing moment terms did not change appreciably for the icing 
condition for this airplane, and did not prove useful to include. The damping terms, such as C mq and C/ , 

which did show differences with icing, were the most difficult for RT-PID to obtain with great accuracy, 
and proved to adversely affect the robustness of the ISP calculation and so were not used. 

n 

z 

i = 1 

ISP = — 

n 

The control terms, i.e., the S e and 8 a moment derivatives, were generally determined with great 
accuracy by the RT-PID routine, and showed icing effects very well. Consequently, they were used for 
the calculation. Elevator deflection did not strongly affect the normal force coefficient, and therefore this 
term was not used. The terms for longitudinal and lateral stability, C m<j and C/ p were also used. The 

final terms that ended up being used, were: 


( Value eX p ectec j Value actua i ) . 
( Value eX p ectec j — Value lcctl 


r 

C b 

c 

C/ 6o 

C N a 



Additional logic was also added to consider the relative predicted error in each term, in the form of 

RT-PID_e rror 
RT-PID value 

If the relative error for any term became larger than an experimentally determined threshold, the term 
was dropped from the ISP calculation. As a result, any term whose error represented a sufficiently large 
portion of its total value would not adversely influence the ISP calculation. As will be discussed further, 
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the relative error in the pitching moment due to elevator deflection derivative was such a critical value to 
the ISP calculation and one of the earliest indicators of building errors in the RT-P1D results, that its 
relative error build up was used as one of the keys to forcing a reset of the RT-P1D routine. 

Thresholds and Latching 

For each change in mode of operation as well as messaging, there were thresholds that needed to be 
met before the change could occur or the message appear. There was also latching and delatching logic 
that specified that the condition had to be met for a specified period of time before it would appear and, 
conversely, the condition had to disappear for a period of time for it to be removed. These were 
incorporated so that the messages would not “flash” off and on if the conditions were right on the edge of 
meeting the requirements for display. 

RT-PID Reset 

As was mentioned earlier, it was found that it was necessary to force a reset of the RT-PID routine 
periodically for best operation. The RT-PID calculations make use of past values which works well if 
there is no change in the aircraft configuration or flight condition. However, when there are changes, the 
time histories of past values can incorrectly influence the calculations at the new configuration and/or 
flight condition. Consequently, a reset, which flushes the buffers and essentially restarts the calculations, 
is required whenever those conditions occur. In addition, evaluations of the system showed that better 
results would occur with periodic resets even when no significant changes occurred. For the evaluation 
phase, the system was set to do an RT-PID reset after 50 sec if one did not occur before then for either of 
the other two specified reasons. While control excitations were not directly commanded upon reset, they 
generally did occur shortly after the reset because the reset created the conditions that caused the system 
to command the excitations. 

Conditions for Warning/Caution Messages 

Messages that warned of deficiencies in a particular axis or of aircraft performance limitations were 
displayed on the PFD. The conditions under which these messages would appear, and whether they 
appeared as cautions (amber messages) or warnings (red messages) were based on the amount of 
degradation in certain aerodynamic parameters from the baseline clean airplane values. Whenever a 
caution or warning message is displayed, the corresponding primary control surface on the airplane 
representation on the FCD page is also colored appropriate to the message (amber for cautions and red for 
warnings). The caution or warning message is also repeated in the message section of the FCD page. 

The initial trials of the ICEPro system considered stability and damping terms in each axis, as well as 
control effectiveness to determine when a caution or warning message should be displayed. In practice, it 
was found that the meaningful stability and damping thresholds were rarely attained and so these terms 
were dropped and only the control effectiveness terms were used. Consequently, the conditions that will 
generate a pitch, roll, or yaw degraded message are as shown below (because the control derivatives are 
all negative terms, the inequality signs may seem reversed): 

0.50 • C m § e no . ice < C m § e < 0.25 • C m g e no . ice , then amber PTCH DGRD and amber 8e on FCD 

C w § e < 0.25 • C m 5 e no .j ce , then red PTCH DGRD and red 8e on FCD 

0.50 • C„§ r no .j ce < C„§ r < 0.25 • C„§,. no .j ce , then amber YAW DGRD and amber 8r on FCD 

C„§,. < 0.25 • C„§ r n0 'i ce , then red YAW DGRD and red 8r on FCD 

0.50 • C/§„ no . ice < C;g a < 0.25 • Ci § a no .j ce , then amber ROLL DGRD and amber 8 a on FCD 

C/g a < 0.25 • C/§ fl no-ice > then red ROLL DGRD and red 8 a on FCD 
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Calculations of single engine rate of climb capability were made using the simulation data and Twin 
Otter handbook values. Tables of these values as functions of flap deflection, ice condition, and altitude 
were stored in the ICEPro routines. Whenever the system was in the Reporting mode and the flight and 
icing condition resulted in predicted single engine rate of climb levels below specified thresholds, a climb 
limit caution or warning message would appear on the PFD and in the FCD message box. In addition, a 
corresponding flap limit message would appear and the flaps on the airplane representation presented on 
the FCD page would be colored either amber or red, corresponding to the caution/waming messages. This 
was meant to alert the pilot that the flap deflection should be reduced for safe operation in the event of an 
engine failure. The thresholds used during the evaluations were: 

0 fpm < SingEngROC < 100 fpm, then amber CFMB FIM and FFAP FIM 

SingEngROC < 0 fpm, then red CFMB FIM and FFAP FIM 

Stall Warning and Decluttering 

A stall warning was added to the system that consisted of a large red STAFF message appearing near 
the middle of the PFD and an aural two-note tone. The aural warning would come on whenever the 
calculated stall angle of attack was attained, and the message would appear on the PFD when the angle of 
attack was 2° above the calculated stall angle. During the system development, it was found that during 
the low-speed highly dynamic environment present during a stall, RT-P1D data extraction evidently had 
trouble keeping up with the rapid change in aerodynamic characteristics in that region and some 
extraneous waming/caution messages would appear, and then would go away after the airplane was 
stabilized. Rather than spend a significant time refining the thresholds and logic, it was decided, based on 
piloted evaluations during the development, that it was best to eliminate the messaging entirely during a 
stall and recovery to allow the pilot to concentrate on recovering the airplane without the distractions of 
any messages. Consequently, logic was incoiporated to “declutter” the PFD by eliminating all ICEPro 
related messaging during this period. The angle of attack bars and speed carets did remain on the PFD, 
because these would aid the pilot during the recovery effort. While these cues do depend somewhat on the 
RT-PID results as it affects the ISP, the ISP calculation is heavily filtered to yield a more or less steady- 
state level and should be only marginally influenced by the rapid changes during a stall and recovery. 

Accommodations for Pilot Evaluations 

In preparation for the piloted evaluations that took place during August 2009, several additions were 
added to the simulation. To represent to the pilot that he was operating an aircraft without icing 
protection, a message stating “IPS failure” was displayed in the FCD message box along with an aural cue 
to indicate that the icing protection system had failed. 

A stick shaker and stick pusher function were added to the longitudinal yoke loader. These were 
configured to operate in a manner consistent with real-world shakers and pushers and would act as a 
forceful cue to the pilot that wing stall was about to, or had occurred. The shaker was sufficiently rapid 
and forceiul that it could not be missed during the most intense flight condition. The pusher was forceful 
enough that it would force the airplane back to an un-stalled angle of attack. Monitoring when the shaker 
or pusher was activated also proved to be an important tool in interpreting and assessing the performance 
during post-flight analysis. 

The shaker was configured to come on at the same time as the angle of attack bars turned from white 
to amber, which was 2° below the stall angle of attack. The stick pusher came on at approximately the 
same time that the stall message appeared on the PFD. 

Conclusion 

In keeping with the NASA goal to improve the safety of commercial and general aviation aircraft, an 
envelope protection system was developed using no direct ice detection devices. Through the use of 
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measured data, a priori information, and real-time stability and control estimates, this system computes an 
icing severity parameter. This parameter is used to trigger appropriate pilot cueing to warn the pilot of 
hazardous conditions and provide guidance for action to mitigate the situation. The main advantage of the 
system is that it uses data that are readily available in modem avionics systems and once adjusted to 
specific aircraft makes and models, and mated to modern display systems, should provide sufficient pilot 
cueing for envelope protection against icing related incidents. 

The utility of the Icing Contamination Envelope Protection (ICEPro) system for mitigating a 
potentially hazardous icing condition was evaluated by 29 pilots using the 1CEFTD. The pilots 
participating in this test were divided into two groups; a control group using baseline displays without 
ICEPro, and an experimental group using ICEPro driven display cueing. Each group flew identical 
precision approach and missed approach procedures with a simulated ice protection failure icing 
configuration. Pilot perfomiance, workload, and survey questionnaires were collected for both groups of 
pilots. Results showed that real time assessment cues were effective in reducing the number of potentially 
hazardous upset events and in lessening exposure to loss of control following an incipient upset condition. 
Pilot workload with the added ICEPro displays was not measurably affected, but pilot opinion surveys 
showed that real time cueing greatly improved their situation awareness of a hazardous aircraft state. A 
detailed discussion of these evaluations and results are presented in another paper presented at this 
conference (Ref. 19). 
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Appendix. — Symbols List 


A Stability matrix 

a k k- th row of matrix A 

B Control matrix 

b k k- th row of matrix B 

C Stability matrix 

b Reference span 

c Mean aerodynamic chord 

C/p Rolling moment due to sideslip angle derivative, dCj /op 

C/ Rolling moment due to aileron deflection derivative, oQ /G8 a 

Ci Rolling moment due to rudder deflection derivative, GCj/Gd,. 

Ci Rolling moment due to non-dimensional roll rate derivative, dCj /d(pb/2V ) 

C/ Rolling moment due to non-dimensional yaw rate derivative, oQ /S(rb/2V ) 

C m Pitching moment due to angle of attack derivative, 8C m /da 

C m Pitching moment due to elevator deflection derivative, GC m /G8 e 

C m Pitching moment due to non-dimensional pitch rate derivative, dC m /d(qc/ 2V ) 

C V(( Normal force due to angle of attack derivative, dC N / Ga 

C N&e Normal force due to elevator deflection derivative, 6C^ /Gb e 

C N Normal force due to non-dimensional pitch rate derivative, GC^/G{qc/2V) 

C„ Yawing moment due to sideslip angle derivative, 5C„/5p 

C„ ga Yawing moment due to aileron deflection derivative, GC n / Gb a 

C n&r Yawing moment due to rudder deflection derivative, QC n /G8 r 

C n Yawing moment due to non-dimensional roll rate derivative, GC n /G(pb/2V) 

C„ r Yawing moment due to non-dimensional yaw rate derivative, GC n /G{rb/ 2V ) 

C v Side force due to sideslip angle derivative, GCy /Gfi 

C v .. a Side force due to aileron deflection derivative, GCy / G5 a 

Cy Sr Side force due to rudder deflection derivative, GCy /G8r 

C Yp Side force due to non-dimensional roll rate derivative, GCy /S{pb/ 2V ) 

Cj- Side force due to non-dimensional yaw rate derivative, GCy /G(rb[2V ) 

D Control matrix 

FCD Flight Control Display 

IPS lee Protection System 
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ISP 

J 

LSE 

PFD 

RMS 

SLD 

t 

U 

u 

u 

u k 

V 

y> y 

X 

x 0 

x k 

e 

0 

d 

co 


Icing Severity Parameter 
Cost function 
Least-squared error 
Primary Flight Display 
Root-mean square 
Super-cooled Large Droplet 
Time 

Theil Coefficient 
Control vector 

Control vector predicted from inversion routine 
Control 

True velocity, ft/s 
Measured and predicted output 
State vector 

State vector initial condition 
State 

Parameter vector 
Estimated parameter 
Confidence bound 
Frequency, rad/s 
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